Devs should consider migrating from xz to lzip, which is an improved LZMA container in multiple ways:

https://www.nongnu.org/lzip/xz_inadequate.html

Not only it is irrelevant in the context of Docker images, but also lzip is not that superior to xz; the linked post only covers minor concerns and both lzip and xz are substantially simpler than the actual meat---LZMA bitstream format.

That might be true but it’s not really relevant to this post: stale Docker images with vulnerabilities lingering on DockerHub can happen to any software package.